Отправить #796230: Cesanta Mongoose 7.20 Denial of Service

The handle_opt() function in /src/net_builtin.c enters an infinite loop when parsing a TCP option with a zero-length field, permanently freezing the entire Mongoose event loop with a single unauthenticated packet. The function iterates over TCP options and uses the attacker-controlled optlen field to advance through the option bytes, but never validates that optlen is non-zero. When optlen is 0, the loop executes opts += 0; len -= 0; on every iteration, and so the pointer never advances, the remaining length never decreases, and the loop condition len > 0 remains true forever.

This vulnerability is triggered in the initial frame receive path of mg_mgr_poll(), before any TCP connection is created, before any protocol parsing (HTTP, MQTT, WebSocket, TLS), and before any authentication. A single TCP SYN packet with a malformed option field is sufficient. Because Mongoose uses a single-threaded event loop by default, the infinite loop freezes the entire device permanently. No existing connections can make progress, no new connections can be accepted, no timers fire, and no recovery is possible without a power cycle or watchdog reset.

Vendor was made aware of the vulnerability and a patch has been released in v7.21.

• Источник: ⚠️ https://github.com/dwBruijn/CVEs/blob/main/Mongoose/TCP_opt_dos.md
• Пользователь: dwbruijn (UID 93926)
• Представление: 03.04.2026 07:23 (22 дни назад)
• Модерация: 24.04.2026 21:12 (22 days later)
• Статус: принято
• Запись VulDB: 359528 [Cesanta Mongoose до 7.20 TCP Option /src/net_builtin.c handle_opt optlen отказ в обслуживании]
• Баллы: 20